{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b3082b04-b048-440c-aaf0-5fd108678920",
   "metadata": {},
   "outputs": [],
   "source": [
    "## Goes with the taskIntercept.yml file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "79b18896-2a90-4c02-b8d7-d4d4c5638ce7",
   "metadata": {},
   "outputs": [],
   "source": [
    "from mythic import mythic"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "633f1627-f4a0-4814-aece-e1b66a8f1150",
   "metadata": {},
   "outputs": [],
   "source": [
    "mythic_instance = await mythic.login(\n",
    "        username=\"mythic_admin\",\n",
    "        password=\"mythic_password\",\n",
    "        server_ip=\"mythic_nginx\",\n",
    "        server_port=7443,\n",
    "        timeout=-1\n",
    "    )"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a25540d1-a301-453b-8977-ff790bb9378a",
   "metadata": {},
   "outputs": [],
   "source": [
    "## trigger: task_intercept\n",
    "# if blocked, this appears as an OPSEC POST block\n",
    "# the same rules for allowing blocked tasks applies as they do to task opsec functions\n",
    "# you can set it so that anybody, the lead, or a different operator has to submit the bypass request"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6c60d502-3f68-4a4a-957d-2196e26e8a5c",
   "metadata": {},
   "outputs": [],
   "source": [
    "## action: task_intercept\n",
    "\n",
    "#  - name: \"binaryCheck\"\n",
    "#    description: \"block a task if it has any bad strings in binaries\"\n",
    "#    action: \"task_intercept\"\n",
    "#    action_data:\n",
    "#      container_name: \"opsecChecker\" <-- which container's task intercept function do you want to execute\n",
    "#                      ^ a container can only have one task_intercept function\n",
    "#                      ^ this example is in the ExampleContainers repo\n",
    "#    inputs: <-- env.* here is all of the task information\n",
    "#      apitoken: \"mythic.apitoken\" <-- any inputs you want so that you can determine if you want to block the task or not\n",
    "#      command: \"env.command_name\"\n",
    "#      params: \"env.params\""
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}
